Building a website in Oman: OmanNet, the 2026 data-protection deadline and winning tourism bookings

Oman is growing fast as a tourism destination and as a base for logistics and industry around Sohar, Duqm and Salalah, and its web rules have caught up with the rest of the Gulf in the last two years. Here is what a website in Oman needs in 2026, whether you run a hotel in Muscat, a tour company in Salalah or a trading business in Sohar.

Two audiences, two languages

Omani customers, government buyers and most local companies read Arabic first. Tourists and foreign investors read English, and a large share of European visitors book in German or French. Most Omani websites have to serve both:

• Arabic and English as the base, built as real versions with right-to-left layout, an Arabic typeface, Arabic titles and hreflang="ar-OM" and "en-OM" tags.
• For tour operators and hotels, German and French pages for the main booking content, which is where European search traffic comes from.
• Arabic written in Gulf Arabic and reviewed by an Omani speaker; the dialect is distinctive and readers notice imported phrasing.

OmanNet and Thawani at checkout

OmanNet is the national debit-card network, and most residents use it online rather than a credit card. The expected payment set:

• OmanNet through a local gateway: Thawani, Amwal Pay, Bank Muscat and Checkout.com all support it.
• Thawani Pay, the most used wallet, and Apple Pay.
• Visa and Mastercard for visitors and expatriates.
• Cash on delivery for retail, which is still common outside Muscat.

For tourism businesses, the booking engine must accept international cards cleanly, since most guests pay from abroad, while the local gateway handles Omani customers.

VAT at 5% and the VATIN

Oman introduced VAT at 5% in April 2021. VAT-registered businesses show their VATIN (the letters OM followed by ten digits) on tax invoices and, sensibly, in the website footer. Consumer prices are shown VAT-inclusive. Tourism services are taxable at the standard rate, so booking totals need to state the VAT clearly, and hotels add the tourism and municipality levies on top.

The Oman PDPL, fully in force since February 2026

Oman's Personal Data Protection Law (Royal Decree 6/2022) came fully into effect on 5 February 2026 after the transition period ended, with the Ministry of Transport, Communications and Information Technology supervising. For a business website it means:

• A privacy policy in Arabic and English covering what you collect, why, how long you keep it, who you share it with and how to exercise rights.
• Explicit consent for marketing and for non-essential cookies, recorded and withdrawable.
• Permission from the Ministry before processing sensitive data such as health or religious information, which affects clinics in particular.
• Rules on transferring data outside Oman: allowed when the destination has adequate protection or with the right safeguards, and the policy has to describe what you do. Booking engines hosted abroad fall under this.

Sites built before 2026 often have a generic policy copied from a UAE template; now is the time to replace it.

Tourism and hospitality specifics

Oman's tourism season runs from October to April, with Salalah's khareef season in July and August. A tourism website needs:

• Real-time availability and booking, with a channel manager if you also sell through booking platforms, so you are never double-booked.
• Hotel, TouristAttraction or TouristTrip schema so Google can show rates and availability in search.
• Itineraries and prices in the languages your guests search in, and content for the places they search for: Wadi Shab, Jebel Akhdar, Nizwa, the Daymaniyat Islands, Salalah in khareef.
• Ministry of Heritage and Tourism licence details for operators and hotels.
• WhatsApp as the enquiry channel, which both Omani and visiting guests use.

Signals of an Omani business

• Your Commercial Registration number from Invest Easy and the registered Arabic name in the footer.
• Your VATIN if registered.
• An Omani phone number (+968) and a WhatsApp button.
• An address in a named area, such as Al Mouj, Qurum, Seeb, Salalah or Sohar, matching your Google Business Profile.
• LocalBusiness schema with addressCountry: "OM" and a Friday–Saturday weekend in the opening hours.
• A .om or .com.om domain pointing at the main site.

A checklist before launch

1. Arabic and English (plus German or French for tourism), reviewed by native speakers.
2. OmanNet, Thawani, Apple Pay and international cards at checkout; VAT-inclusive prices.
3. VATIN in the footer and compliant tax invoices.
4. Privacy policy and consent written for the Oman PDPL.
5. CR, +968 number, WhatsApp and an area address in the footer.
6. Booking engine, schema and a Google Business Profile for hospitality.

Run your site through the GCC Website Checker with Oman selected to see which of these are missing.